[Mark Tomlinson]

I need to make some corrections to my original posting about using the LDAP bind for authentication. Unfortunately, there were two errors in the code which was causing @ldap_bind to do an anonymous bind. If your directory does not allow anonymous, then the code would fail. If your directory does allow anonymous, then any password would work.

Here is the corrected code from ldap_authentication.php.

				//... check if the username and password entered in the login form are correct (in LDAP)
				//by default LDAP stores passwords in CRYPT format, but we'd need to know the plain text
				//password to check against CRYPT. VB converts the password into MD5 on form submission
				//and because we have the password already stored as MD5 in LDAP, we can do this!
//	----	Modified by Mark Tomlinson - 11/28/2007 ----
//				if($info[0]["$ldapfield"][0] == $_POST[vb_login_md5password])
				if (@ldap_bind($ds, $info[0]["dn"], $_POST[vb_login_password]))
//	----	End Modifications	----
				{

Also, this code has "dn" hard-coded into it. Your directory may need to use the CN or UID attributes. Chris has suggested that we can reuse $ldapfield for that purpose.